ci(release): sign artifacts with cosign keyless signing (#61)

Add cosign signing to GoReleaser config to produce a sigstore bundle
(checksums.txt.sigstore.json) alongside each release. Update the release
workflow with id-token:write permission and sigstore/cosign-installer so
signing uses GitHub's OIDC token without any managed keys.

Author: danmrichards

.github/workflows/release.yml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   release:
@@ -29,6 +30,9 @@ jobs:
           config: cliff.toml
           args: --latest --strip header --output CHANGELOG.md
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.0
+
       - uses: goreleaser/goreleaser-action@v6
         with:
           version: "~> v2"

.goreleaser.yaml

@@ -26,6 +26,16 @@ archives:
 checksum:
   name_template: "checksums.txt"
 
+signs:
+  - cmd: cosign
+    signature: "${artifact}.sigstore.json"
+    args:
+      - "sign-blob"
+      - "--bundle=${signature}"
+      - "${artifact}"
+      - "--yes"
+    artifacts: checksum
+
 homebrew_casks:
   - name: runware
     homepage: https://runware.ai